Commit Graph

35676 Commits

Author SHA1 Message Date
Yanase Yuki d32ce5d8c4 svox: remove package
This software seems no longer maintained by upstream.
The latest upstream commit is 8 years ago,
and no package depends on this.

Signed-off-by: Yanase Yuki <dev@zpc.st>
2026-03-05 19:52:17 -03:00
Yanase Yuki 704d2a325b open2300: remove package
This software is no longer maintained by upstream.
No package depends on this.

Signed-off-by: Yanase Yuki <dev@zpc.st>
2026-03-05 19:40:32 -03:00
Orne Brocaar 4c3a649dd7 rust: set llvm.download-ci-llvm=false
These LLVM builds get deleted after a certain time, causing Rust builds
to break as the LLVM build can no longer be downloaded.

Fixes #27331.

Signed-off-by: Orne Brocaar <info@brocaar.com>
2026-03-06 00:38:44 +02:00
Dirk Brenken 57ec85084c adblock: update 4.5.2‑2
* fixed the debug errorfile handling
* fixed a typo in the nftadd function
* minor cornercase improvements
* LuCI: minor cleanups & fixes

Signed-off-by: Dirk Brenken <dev@brenken.org>
2026-03-05 21:04:07 +01:00
Sandro Jäckel f24ebb4f11 tailscale: update to 1.94.2
Changelog: https://tailscale.com/changelog#2026-02-12

Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
2026-03-05 18:05:58 +02:00
George Sapkin b9148c1494 adguardhome: add GC and thread control variables
Add Go GC and threading control variables - GOGC, GOMEMLIMIT, and
GOMAXPROCS - to allow more granular control of the memory management on
lower memory devices.

Fixes: https://github.com/openwrt/packages/issues/28676
Link: https://go.dev/doc/gc-guide#GOGC
Link: https://pkg.go.dev/runtime#pkg-overview
Link: https://go.dev/blog/container-aware-gomaxprocs
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-05 17:26:57 +02:00
George Sapkin c5dd05c5bd syncthing: bump to 2.0.15
Changes: https://github.com/syncthing/syncthing/releases/tag/v2.0.15
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-05 16:22:39 +02:00
George Sapkin b0e4c18efc yt-dlp: bump to 2026.03.03
Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.03
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-05 16:21:56 +02:00
Florian Eckert 803e8ae3f7 openvpn: increment PKG_RELEASE by one
Increment PKG_RELEASE by one.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Florian Eckert 8816657223 openvpn: move usr/share/openvpn files into its own dir
By moving the file to a subdirectory, it is easier to track where the file
is located on the target without having to check the Makefile every time.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Florian Eckert 310c097378 openvpn: move lib/upgrade/keep.d file into its own dir
By moving the file to a subdirectory, it is easier to track where the file
is located on the target without having to check the Makefile every time.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Florian Eckert f1c2f51fc8 openvpn: improve readability for files install target
Each script to be installed is moved to its own line to improve readability.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Florian Eckert 9d2de51e06 openvpn: remove not needed INSTALL_DIR creations
This 'INSTALL_DIR' creation are not needed anymore after refactoring.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Florian Eckert 27df3c8341 openvpn: refactoring INSTALL_DIR command call during install
Move the 'INSTALL_DIR' creation in the make install target to the location
where the files are also installed. This prevents directories that are no
longer needed from being forgotten during refactoring.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-03-05 07:54:01 +01:00
Stan Grishin 4c4f8c303e adblock-fast: update to 1.2.2-r8
* bugfix: support TMP and final block-list destination on different
  partitions
* update pause-related code/defaults/validation

Signed-off-by: Stan Grishin <stangri@melmac.ca>
2026-03-04 12:22:17 -08:00
Daniel F. Dickinson 5eaff0b9c0 zabbix: bump version to 7.0.23 (LTS)
Update version to 7.0.23 - latest LTS.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-04 20:27:09 +02:00
Daniel F. Dickinson c98e9d68a0 zabbix: add full variants and add-on support for other
Rather than having a database selection for SQLITE which prevents
the server or frontend from building, we add a 'basic'
variant for the proxy which uses sqlite3, and have the database
Kconfig affect only the server and frontend.

* There are now only three variants:
  1. full, which is the default. It includes the full monitoring feature
     set currently available on openwrt, including netsnmp, curl-based
     checks, and ldap. In addition these features, plus the choice of
     database and ssl provider (or no ssl) are configuration options for
     this variant.
  2. basic, which provides basic functions with openssl support
  3. no-configure, for packages which are not part of the main Zabbix
     compile process (including the WebUI which only requires copying
     files for use by a web server with PHP CGI support).

* Full is the default variant for agentd and proxy, which are the only
  packages with a choice between full and basic. All other packages only
  are part of one variant.

* Full variants are the base version of the packages (that is
  zabbix-agentd is the 'full' version while zabbix-agentd-basic is the
  core version). The proxy version is named zabbix-proxy-basic-sqlite to
  announce that it is using the sqlite3 database and not a database
  server.

* get and sender only build if at least one of agentd, server, or proxy
are built. Therefore prevent selection get or sender when they would not
build.

* Zabbix's use of NetSNMP requires that Zabbix be build with OpenSSL

* While we are here, enable support for dates after 2038 (64-bit time_t)

* https://github.com/openwrt/packages/pull/28585#issuecomment-3984978895
  * we updated the name to reflect that it is for basic functionality
    that can standalone, rather then being a core the other packages
    build on.
  * basic has been used rather than tiny or small since the sentence
    'Provides only tiny/small functionality with SSL/TLS' in the
    description, sounds strange, but using basic this reads properly.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-04 20:27:09 +02:00
Daniel F. Dickinson 4afdeb7d19 zabbix: update php8 dependencies
Using the php8 dependency allows use to go back to using the
+ZABBIX_POSTGRESQL:php8-mod-pgsql (and like dependency for
mysql/mariadb).

This has the benefit of being an apk dependency so the user does not
install the frontend without a php8 database module.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-04 20:27:09 +02:00
Toke Høiland-Jørgensen 487e64757d net/radsecproxy: Remove myself as maintainer
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
2026-03-04 14:25:49 +01:00
Chester A. Unal 91e2ddb985 bsbf-resources: update to GIT HEAD of 2026-03-03
Update bsbf-resources to the GIT HEAD of 2026-03-03.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-04 12:41:29 +02:00
Chester A. Unal a6be73da21 bsbf-autoconf-cellular: add
bsbf-autoconf-cellular creates a network with MBIM or QMI protocol using a
newly created network interface. It uses metric values from 1 to 8.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-04 12:41:29 +02:00
Chester A. Unal 6037422f53 bsbf-openwrt-resources: add
Designate bsbf-openwrt-resources as the package to contain the BSBF
packages without a remote source to fetch.

Move bsbf-bonding and bsbf-usb-netdev-autodhcp into bsbf-openwrt-resources.
Change bsbf-usb-netdev-autodhcp to bsbf-autoconf-dhcp along with the logic.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-04 12:41:29 +02:00
Stan Grishin 7d0db39fc8 https-dns-proxy: update to 2025.12.29-4
* add explicit LICENSE file to the repository
* pretty up Makefile
* minor shell script styling improvements
* better parsing if individual dnsmasq instances are used in config
* functional test

Signed-off-by: Stan Grishin <stangri@melmac.ca>
2026-03-03 17:43:22 -08:00
Stan Grishin 38313ec4b4 pbr: update to 1.2.2-r8
* bugfix: don't mask RFC1918 in the support output
* bugfix: proper processing of downed interfaces

Thanks to everyone who reported/tested and @egc112 for collecting feedback.

Signed-off-by: Stan Grishin <stangri@melmac.ca>
2026-03-03 17:41:55 -08:00
Daniel F. Dickinson 072f32fee3 nut: fix no permissions to use USB UPS, and more
When a USB UPS is first configured, the permissions on the device under
`/dev/bus/usb` have not yet been set to allow the nut user access. This
resulted in errors such as:

Fri Feb 13 23:39:01 2026 daemon.debug upsd[3504]: [D1] mainloop: UPS
[eco550ups] is not currently connected, trying to reconnect
Fri Feb 13 23:39:01 2026 daemon.debug upsd[3504]: [D1] mainloop: UPS
[eco550ups] is still not connected (FD -1)
Fri Feb 13 23:39:03 2026 daemon.debug upsd[3504]: [D1] mainloop: UPS
[eco550ups] is not currently connected, trying to reconnect
Fri Feb 13 23:39:03 2026 daemon.debug upsd[3504]: [D1] mainloop: UPS
[eco550ups] is still not connected (FD -1)

or

Fri Feb 13 23:38:44 2026 daemon.err usbhid-ups[3083]: No matching HID
UPS found
Fri Feb 13 23:38:49 2026 daemon.warn procd: failed adding instance
cgroup for nut-server: No error information
Fri Feb 13 23:38:49 2026 daemon.err usbhid-ups[3115]: libusb1: Could not
open any HID devices: insufficient permissions on everything
Fri Feb 13 23:38:49 2026 daemon.err usbhid-ups[3115]: No matching HID
UPS found
Fri Feb 13 23:38:54 2026 daemon.warn procd: failed adding instance
cgroup for nut-server: No error information

and upsd would enter a procd crashloop.

We fix that by looking in `sysfs` (under `/sys/devices`) to find the
correct USB device and set its ownership and permissions to allow acces
to the user the driver is running under.

Copilot complained about a few things

* nut-server.init had potential word-splitting issues in various spots.
* it also had some commands missing an argument
* improved documentation was required to clarify a dependency
* an incorrect sed could mangle names as well as remove the intended
  name

Additionally, while fixing those issues the author noticed that the case
of multiple UPS devices with the same vendorid:productid were not
correctly handled. A check of the serial number, if provided, was added
along with a fallback to allowing NUT communications with all UPS
devices with a given vendorid:productid, if no serial number was given.

Improve efficiency and decrease McCabe complexity of
ensure_usb_ups_access, while also fixing Copilot complaints.

$@ in case is a problem, and we only handle the first parameter in any
event, so change $@ to "$1"

Copilot caught a missing 2>&1 and we silence some shellcheck
false positives

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 19:53:14 +01:00
Daniel F. Dickinson 9cfa3f657d nut: comment and simplify server script
Attempt to de-mystify the nut-server initscript by adding comments
and factoring out some common code that adds to complexity of the
functions of which it is part.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 19:53:14 +01:00
Daniel F. Dickinson 688c20bc78 nut: stop de-configured ups
Ensure that when a ups is removed from the configuration that its
driver instance is stopped.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 19:53:14 +01:00
Daniel F. Dickinson 90d3d1e9d0 nut: fix driver, server, and monitor reload/stop
Updated configuration was not being applied after config change. This
was due to the means used to do the daemon reloads.

Closes #28298 "Drivers not restarted on config change"

Enable creating PID files for the server, driver, and monitor daemon
processes. This allows to use NUT's built-in facilities for signalling
the daemon's.

For server, when reloading:
1. Check if upsd is running
   1. If not, start it.
   2. If it is send reload signal to upsd
2. For each driver:
   1. Check if the driver is running
      1. If it is, send reload-or-exit signal to driver
      2. If driver is not running, start it
3. Attempt to start server (upsd and drivers) if service was stopped.

For server, when stopping:
1. Check if upsd is running
   1. If it is send stop signal to upsd
   2. Ensure it really is stopped
2. For each driver:
   1. Check if the driver is running
      1. If it is, send stop signal to driver
      2. If driver is still running, stop it.
3. If the server process is active (even with not upsd or drivers),
   stop it.

For monitor, send the reload signal on config change, with fallback to
stopping and starting the daemon.

Change the names of variables and functions to make it more clear what
is being acted on, configured, or otherwise touched.

Avoid confusing messages in syslog

* Avoid attempting to remove a procd server instance that does not exist
  as doing so results in confusing/scary messages in syslog, such as:

  Command failed: ubus call service delete
  { "name": "nut-server", "instance": "upsd" } (Not found)

In NUT some models of UPS use shutdown_delay rather than offdelay, and
yet others use usd for the same purpose. shutdown_delay and usd were
previously not available in the list of available driver options, so
add them.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 19:53:14 +01:00
Daniel F. Dickinson 7eafd0ada6 nut: add linting and fix whitespace and typos
shellcheck is a useful linter if a bit pedantic and overzealous so
add overrides to silence false positives

Also, fix issues found by the linting.

* misspelling meant initscript could skip updating configuration in
  certain circumstances
* minor: assignment of the result of execution as the time of creating
  local. This has been separated.

Fix whitespace and comment typos
Fix typo in Config.in option text
* This is cosmetic, but user-facing (for users building via SDK or
  buildroot).

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 19:53:14 +01:00
Daniel F. Dickinson 14e0e9e737 watchcat: fix interface reset does not work
As reported in #23410 Network interface reset doesn't work as expected
on a Wireguard VPN interface and in #27927 lt2p interface won't reboot,
and mentioned in #27248, the current implementation of the option to
restart an interface when connectivity check fails for some period does
not result in an interface restart for all interface.

Notably 'virtual' interfaces such as Wireguard and L2TP do not restart.

The solution that works is to use `ifup <interface>` instead of only
changing the link status.

This commit is based on the one in #27248 by @rondoval, who unfortunately
has not updated the commit message as requested for half a year.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-03-03 20:06:13 +02:00
Paul Donald e026ce0f01 openvpn: handle ovpnproto exclusively
Since proto was migrated to ovpnproto to avoid collision
with netifd proto, this shall be handled separately.

Also avoid using uci commands to migrate the config which
requires knowing property types; use awk instead.

follow-up to 2607b76154

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
2026-03-03 17:23:53 +02:00
Qingfang Deng f8aba26c7f mdio-netlink: do not select KCONFIG
mdio-netlink is forcing all targets in buildbot to build PHY and MDIO
support. Convert the dependency into the PHYLIB kmod to avoid that.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
2026-03-03 10:52:41 +01:00
Patrick Hemmen 3dd1f337eb ddns-scripts: change servercow.de to new dns api
The previous way to update dns records at servercow.de was replaced
with a https based dns api. The new dns api is documented at
https://wiki.servercow.de/de/domains/dns_api/api-syntax/#einfuhrung

Signed-off-by: Patrick Hemmen <jummo4@yahoo.de>
2026-03-02 13:45:34 +01:00
Oliver Sedlbauer 8744a706f1 acpid: prevent duplicate daemon instances
The hotplug script directly invokes /usr/sbin/acpid. If hotplug fires
before procd starts acpid, it cannot stop the procd-managed instance,
resulting in a second unmanaged acpid process running alongside it.

Fix this issue by letting ONLY procd manage the acpi daemon.

Signed-off-by: Oliver Sedlbauer <os@dev.tdt.de>
2026-03-02 13:37:58 +01:00
Oliver Sedlbauer 4faa112269 gpsd: add wrapper script for hotplug/respawn handling
Gpsd needs some time to create its Unix socket after the process starts.
The hotplug call in service_started() is triggered too early, before the
socket is ready, causing failures in scripts that depend on it.

Additionally, when gpsd crashes and procd respawns it, service_started() is
not called again, so no hotplug event is emitted on respawn. Therefore scripts
listening for gpsd availability miss the STARTED event.

This commit ensures the hotplug call waits for the socket to appear,
so dependent scripts reliably see the STARTED event, even after respawns.

Signed-off-by: Oliver Sedlbauer <os@dev.tdt.de>
2026-03-02 13:36:30 +01:00
Chester A. Unal 292214e76a bsbf-bonding: add
bsbf-bonding configures the system for the BondingShouldBeFree bonding
solution client.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-01 20:13:08 +00:00
Chester A. Unal fea7b41d64 bsbf-usb-netdev-autodhcp: add
bsbf-usb-netdev-autodhcp creates a network with a DHCP client using a newly
created network interface. It uses metric values from 1 to 8.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-01 20:13:08 +00:00
Chester A. Unal e69b0b24fa bsbf-resources: add
bsbf-resources contains the resources for the BondingShouldBeFree bonding
solution client.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-01 20:13:08 +00:00
Chester A. Unal ea1ea71298 tcp-in-udp: add
TCP-in-UDP is a lightweight TCP in UDP tunnel utilising eBPF.

Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
2026-03-01 20:13:08 +00:00
Til Kaiser b543052ae0 mstflint: update to 4.35.0-1
This commit updates the mstflint package
to the latest 4.35.0-1 release.

It also includes a patch to fix a build error
that has been merged into their development branch [1]
but is not inside the current release version.

Additionally, the new Python script mstgenerate_pgcb_commands
introduced in 4.35.0 has been added to the package.

Release notes:
https://github.com/Mellanox/mstflint/releases/tag/v4.35.0-1

[1] https://github.com/Mellanox/mstflint/pull/1568

Signed-off-by: Til Kaiser <mail@tk154.de>
2026-03-01 08:49:21 +02:00
Dirk Brenken d4a62496f9 adblock: release 4.5.2‑1
* added a new firewall feature: the DNS‑Bridge.
  This temporary DNS bridge ensures that an external fallback DNS server
  is automatically used during local DNS restarts, providing Zero‑Downtime DNS resolution.
* The debug mode now captures internal error output in a dedicated log file,
  located by default in the adblock base directory as /tmp/adb_error.log.
* LuCI: exposed the previously missing adb_cores option (auto‑detected by default).
* LuCI: added support for the new DNS‑Bridge options (Zero‑Downtime during DNS restarts).

Signed-off-by: Dirk Brenken <dev@brenken.org>
2026-03-01 06:53:25 +01:00
Jon Henrik Bjørnstad 07b918bbc4 qbee-agent: bump version to 2026.10
Bump version to 2026.10

Signed-off-by: Jon Henrik Bjørnstad <jonhenrik@qbee.io>
2026-02-28 17:21:43 +02:00
John Audia e11cd08421 lxc: update to 6.0.6
6.0.5 is a bug fix release, see:
https://discuss.linuxcontainers.org/t/lxc-6-0-6-lts-has-been-released/26294

Full changelog: https://github.com/lxc/lxc/compare/v6.0.5...v6.0.6

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <therealgraysky@proton.me>
2026-02-28 17:21:08 +02:00
Stan Grishin dde3a694f0 pbr: update to 1.2.2-r6
Update pbr from 1.2.1-r87 to 1.2.2-r6. This release
adds mwan4 (Multi-WAN) integration, a diagnostic
`support` command, IPv6 lease-to-nftset handling,
improved split-uplink detection, stricter UCI
validation, shell variable quoting fixes across 30+
locations, and a comprehensive 126-case test suite
with a full mock OpenWrt sysroot.

Signed-off-by: Stan Grishin <stangri@melmac.ca>

---

- **31 files changed**, +1,745 / -227 lines
  (net +1,518)
- **1 commit**: `61c8923` —
  `pbr: update to 1.2.2-r6`

---

- Version bumped from `1.2.1-r87` to `1.2.2-r6`
- URL updated from `github.com/stangri/pbr/` to
  `github.com/mossdef-org/pbr/`
- No dependency changes

---

Three options changed from scalar to list type:

| Option              | Old Type | New Type |
|---------------------|----------|----------|
| `ignored_interface` | `option` | `list`   |
| `lan_device`        | `option` | `list`   |
| `resolver_instance` | `option` | `list`   |

Options reordered: scalars first, then lists,
matching UCI convention. No values changed.

---

The init script (`/etc/init.d/pbr`) received
significant additions and fixes across ~660 lines
(+443/-218).

Bumped from `24` to `25`.

**mwan4 (Multi-WAN) Integration (8 new functions):**
- `mwan4_is_installed()` — Detect mwan4 package
- `mwan4_is_running()` — Check service status
- `mwan4_get_iface_list()` — Get enabled interfaces
- `mwan4_get_strategy_list()` — Get strategies
- `mwan4_get_iface_mark_chain()` — Get nft mark
  chain for interface
- `mwan4_get_iface_nft_sets()` — Get nftset names
- `mwan4_get_strategy_chain()` — Get strategy chain
- `mwan4_get_mmx_mask()` — Get Multi-WAN mark mask

Enables PBR to coordinate with mwan4 for combined
policy routing and multi-WAN failover.

**Diagnostic `support` Command:**
- New `support()` function generates masked
  diagnostic output for troubleshooting
- `print_config_masked()` redacts sensitive data
  (passwords, keys, tokens, PSKs, endpoints)
  while preserving IP addresses and structure

**IPv6 Lease Handling:**
- New `ipv6_leases_to_nftset()` parses DHCPv6
  leases from `/tmp/hosts/odhcpd`
- Complements existing `ipv4_leases_to_nftset()`

**Split Uplink Detection (3 new functions):**
- `is_uplink4()` — Check IPv4 uplink interface
- `is_uplink6()` — Check IPv6 uplink interface
- `is_uplink()` — Unified check (v4 or v6)
- New `ipv6_default_lookup` variable for split
  IPv4/IPv6 uplink routing table assignment

**ubus Integration:**
- New `ubus_get_interface()` queries PBR gateway
  data via ubus

**Shell Variable Quoting (30+ locations):**
Systematic conversion of bare variable references
to brace-quoted syntax throughout the script:
- `$2` to `${2}` in string replacements
- `$_ret` to `${_ret}` in conditional expansions
- `$_mark` to `${_mark}` in nft rule generation
- `$nftset6` to `${nftset6}` in dnsmasq rules
- `$nft_set_timeout` to `${nft_set_timeout}`
- `$xrayIfacePrefix` to `${xrayIfacePrefix}`
- And many more across rule generation, output
  strings, and conditional expressions

**Specific Fixes:**
- `pbr_get_gateway6()`: Changed `is_wan` to
  `is_uplink4` for correct IPv4 uplink detection
- `is_netifd_interface()`: Now checks both
  `ip4table` and `ip6table` (was IPv4 only)
- `load_environment()`: Fixed inverted flag check
  (`-z` changed to `-n` for `loadEnvironmentFlag`)
- Dnsmasq instance detection: Fixed UCI section
  lookup with proper variable handling
- Help text URL: `#WarningMessagesDetails` changed
  to `#warning-messages-details` (kebab-case)

- `uplink_ip_rules_priority`: Changed from
  `uinteger` to `range(99,32765)` to enforce
  valid Linux routing policy DB bounds

Three options now use `config_get_list` instead of
`config_get` to support multiple values:
- `ignored_interface`
- `lan_device`
- `resolver_instance`

**Rule Cleanup Refactored:**
- Replaced complex awk-based rule parsing with
  priority-range approach
- Calculates `prio_min = priority - max_ifaces`
  and `prio_max = priority`, iterates and deletes
  rules within range
- Skips netifd-managed fwmark rules
- Added legacy rule cleanup for
  `suppress_prefixlength` entries

**Firewall Sync:**
- Added `fw4 -q reload` after successful nft file
  installation to ensure fw4 state synchronizes
  with PBR's nftables changes

**Resolver Instance Handling:**
- Added robustness checks in
  `_dnsmasq_instance_config()`: file existence
  check and instance validity check
- Better section name resolution with UCI query
- Added missing `setup` parameter in resolver
  instance setup calls

- `uci_get_device()` — Replaced with inline call
- `uci_get_protocol()` — Replaced with inline call

---

In `70-pbr`, fixed shell variable quoting:
```sh
${DEVICE:+ ($DEVICE)}
${DEVICE:+ (${DEVICE})}
```

---

In `pbr.user.netflix`, fixed two instances of
bare variable expansion in parameter substitution:
```sh
params="${params:+$params, }${p}"
params="${params:+${params}, }${p}"
```

---

A full test suite is added in `net/pbr/tests/`
(21 new files, ~1,300 lines) using the shunit2
framework with a complete mock OpenWrt sysroot.

**Runner (`run_tests.sh`):**
- Discovers test files via glob pattern
- Supports pattern-based filtering via CLI arg
- Executes each test in isolated bash subprocess
- Captures output, reports pass/fail with color
- Accumulates stats and lists failures at end
- Requires `shunit2` package

**Setup (`lib/setup.sh`):**
- Creates temporary mock sysroot (`$MOCK_ROOT`)
- Sets `IPKG_INSTROOT` for OpenWrt path resolution
- Installs mock libraries, configs, and binaries
- Stubs `rc.common`, procd, logger, resolveip,
  jsonfilter, pidof, sync
- Sources pbr init script with `readonly` keyword
  stripped (allows test overrides)
- Redirects all file paths to temp directories

**UCI Config API (`lib/mocks/functions.sh`):**
- Full `config_load` parser for UCI syntax
- `config_get`, `config_get_bool`,
  `config_get_list`, `config_foreach`,
  `config_list_foreach`
- `uci_set`, `uci_get`, `uci_add_list`,
  `uci_remove`, `uci_remove_list`, `uci_commit`
- Stores state in associative arrays

**Network API (`lib/mocks/network.sh`):**
- `network_get_device`, `network_get_physdev`,
  `network_get_gateway`, `network_get_gateway6`,
  `network_get_protocol`, `network_get_ipaddr`,
  `network_get_ip6addr`, `network_get_dnsserver`,
  `network_flush_cache`
- Backed by `MOCK_NET_*` variables that tests
  override to simulate different network states
- Pre-configured: wan (eth0/dhcp/192.168.1.1),
  wan6 (eth0/dhcpv6/fd00::1), wg0 (wireguard),
  lan (br-lan/static), loopback (lo/static)

**JSON Shell (`lib/mocks/jshn.sh`):**
- Minimal JSON-in-shell implementation
- `json_init`, `json_add_string/boolean/int`,
  `json_add_object/array`, `json_close_*`,
  `json_select`, `json_get_var`, `json_get_keys`,
  `json_dump`, `json_load`
- Associative array backend with path tracking

**Mock Binaries:**
- `nft` — Returns fw4 table structure with
  standard chains (input, forward, output,
  dstnat, mangle_*); passes syntax checks
- `dnsmasq` — Reports version with nftset support
- `readlink` — Returns `/usr/libexec/ip-full`
  for `*/sbin/ip` (simulates ip-full installed)

**Mock UCI Configs:**
- `pbr` — Full config: enabled, policies
  (vpn_all, vpn_gaming, disabled_policy),
  dns_policy, nft settings, interface lists
- `network` — Interfaces: loopback, lan, wan,
  wan6, wg0 (wireguard)
- `firewall` — Zones: lan (accept all),
  wan (reject input/forward)
- `dhcp` — DHCP server stub
- `system` — Hostname and timezone

**01_validation — Input Validation (67 cases):**

`01_ipv4_validation` (13 cases):
- Valid IPs: 192.168.1.1, 10.0.0.1, 172.16.0.1
- Valid CIDR: /8, /24, /32, /0
- Invalid: octets >255, wrong octet count,
  CIDR >32, IPv6 addresses, domain names

`02_ipv6_validation` (21 cases):
- Valid: ::1, fe80::1, 2001:db8::1, fd00::1,
  full addresses, ::/0
- Invalid: IPv4 addrs, plain strings, MACs
- Scope detection: global (2001:db8::/32),
  link-local (fe80::/10), ULA (fd00::/8)

`03_domain_validation` (8 cases):
- Host: single labels (router, host123)
- Hostname: multi-label (example.com,
  sub.example.com, deep.sub.example.com)
- Domain: FQDN or single-label
- Invalid: IPs, empty strings, MAC notation

`04_misc_validators` (25 cases):
- MAC addresses (colon notation, case variants)
- Integer validation (positive, not negative)
- Negation marker (! prefix detection)
- URL schemes (http, https, ftp, file://)
- Version comparison (is_greater,
  is_greater_or_equal)
- Family mismatch (IPv4/IPv6 mixing detection)

**02_string_utils — String Functions (8 cases):**

`01_str_functions`:
- `str_contains` — Substring search
- `str_contains_word` — Word-boundary search
- `str_to_lower` / `str_to_upper` — Case convert
- `str_first_word` — Token extraction
- `str_replace` — String substitution
- `str_extras_to_underscore` — Normalize delims
- `str_extras_to_space` — Expand delimiters

**03_wan_detection — Interface Detection
  (13 cases):**

`01_wan_types`:
- `is_wan4` — Detects wan/wanX, not wan6/lan/wg0
- `is_wan6` — Detects wan6/mwan6 (IPv6-aware)
- `is_wan6_disabled` — Disabled when ipv6 off
- `is_wan` — Unified v4+v6 detection
- `is_uplink4` / `is_uplink6` — Uplink detection
- `is_tor` — Case-insensitive tor detection
- `is_ignore_target` — Ignore target detection
- `is_list` — Comma/space list vs single value

**04_config — Configuration Loading (13 cases):**

`01_load_config` (7 cases):
- Default values from UCI config
- Hex value parsing (fw_mask, uplink_mark)
- XOR calculation (fw_maskXor = ~fw_mask)
- List parsing (ignored_interface, resolver)
- nft parameters (auto-merge, flags)
- Config-loaded flag tracking

`02_disabled_service` (2 cases):
- Disabled: enabled option becomes unset
- Enabled: enabled option is set

`03_config_ipv6` (4 cases):
- IPv6 enabled: config and uplink interface set
- IPv6 disabled: both unset
- Reload behavior verification

**05_nft — nftables Integration (14 cases):**

`01_nft_file_operations` (8 cases):
- File creation with nft shebang
- Chain creation (dstnat, forward, output,
  prerouting)
- Jump rules and guard rules
- File append, content search, file deletion

`02_nft_check_element` (6 cases):
- fw4 table existence
- Chain existence (input, forward, output,
  dstnat, mangle_*)
- Non-existent chain detection

**06_network — Network Functions (11 cases):**

`01_gateway_discovery` (4 cases):
- IPv4 gateway from mock (192.168.1.1)
- IPv4 gateway fallback (ip addr parsing)
- IPv6 gateway from mock (fd00::1)
- Interface finding for uplinks

`02_supported_interfaces` (7 cases):
- Ignored: loopback in ignored list
- LAN detection vs non-LAN
- Uplink support (wan is supported)
- LAN/loopback not supported
- Wireguard supported (wg0)
- Explicit custom interface support

---

```sh
cd net/pbr/tests && sh run_tests.sh
```

Requires: `bash`, `shunit2`.
Optional filter: `sh run_tests.sh 01_validation`

Signed-off-by: Stan Grishin <stangri@melmac.ca>
2026-02-26 17:01:02 -08:00
Stan Grishin d06ee022b5 adblock-fast: update to 1.2.2-r6
Update adblock-fast from 1.2.1-r7 to 1.2.2-r6. This is a major
architectural rewrite that ports the core business logic from a ~2,700-line
monolithic shell script (`/etc/init.d/adblock-fast`) to a ~2,850-line ucode
module (`/lib/adblock-fast/adblock-fast.uc`), reducing the init script to a
thin ~130-line procd wrapper. The rewrite also introduces a comprehensive
test suite and adds the AGPL-3.0-or-later LICENSE file.

---

- **36 files changed**, +5,787 / -2,836 lines (net +2,951)
- **1 commit**: `0263b2b` — `adblock-fast: update to 1.2.2-r6`

---

The previous implementation embedded all business logic (download pipeline,
domain processing, resolver configuration, status reporting, caching)
inside the init.d script as a ~2,700-line POSIX shell script. This made the
code difficult to test, maintain, and extend. Shell limitations (no native
data structures, reliance on subshell `eval`, global namespace pollution)
also introduced fragility and performance overhead from repeated subprocess
spawning for UCI/ubus operations.

```
/etc/init.d/adblock-fast          (131 lines) — Thin procd wrapper
/lib/adblock-fast/adblock-fast.uc (2849 lines) — Core logic (ucode)
/lib/adblock-fast/cli.uc          (95 lines)  — CLI action dispatcher
```

The init script now delegates all operations to the ucode module via:
```sh
readonly _ucode="ucode -S -L /lib/${packageName} /lib/${packageName}/cli.uc --"
```

The CLI dispatcher (`cli.uc`) maps init script actions (start, stop,
status, allow, check, pause, etc.) to the module's exported functions.
The init script retains only procd lifecycle glue (`start_service`,
`stop_service`, `service_triggers`, `service_data`) and UCI validation
schemas.

1. **Native UCI/ubus bindings** — Direct `cursor()` and `connect()` calls
   replace subprocess-heavy `uci get/set` and `jsonfilter` pipelines
2. **Proper data structures** — Objects and arrays for config, status
   tracking, DNS mode definitions; no more string-concatenation state
   management
3. **Streaming I/O** — 64KB chunked file reads for blocklist processing
   instead of loading entire files into memory via pipes
4. **Memoized environment detection** — Platform capabilities (installed
   resolvers, ipset/nftset support, downloader detection) cached on first
   call
5. **Centralized trigger logic** — Config diff comparison
   (`adb_config_cache()`) determines download/restart/skip in one place
6. **Testable** — Module exports enable direct unit testing without mocking
   an entire init system

---

- `+ucode` — ucode interpreter runtime
- `+ucode-mod-fs` — Filesystem operations (readfile, writefile, popen,
  stat, etc.)
- `+ucode-mod-uci` — Native UCI cursor API
- `+ucode-mod-ubus` — Native ubus RPC API

- `+jshn` — No longer needed (was used for JSON parsing in shell)

- URL updated from `github.com/stangri/adblock-fast/` to
  `github.com/mossdef-org/adblock-fast/`
- Install target now installs `/lib/adblock-fast/adblock-fast.uc` and
  `/lib/adblock-fast/cli.uc` alongside the init script
- Version stamp now patches the ucode module
  (`version:` field) instead of init script (`PKG_VERSION` variable)
- `postinst` script removed (service enable handled elsewhere)
- `prerm` script simplified: only purges cache, no longer
  stops service or removes rc.d symlinks (handled by procd)

---

The module supports all existing DNS resolver integrations through a
unified `dns_modes{}` configuration map. Each mode defines output file
paths, gzip cache names, sed format/parse filters, and grep patterns:

| Mode                 | Output Format                                    |
|----------------------|--------------------------------------------------|
| `dnsmasq.addnhosts`  | `127.0.0.1 domain` (+ `:: domain` with IPv6)    |
| `dnsmasq.conf`       | `local=/domain/`                                 |
| `dnsmasq.ipset`      | `ipset=/domain/adb`                              |
| `dnsmasq.nftset`     | `nftset=/domain/4#inet#fw4#adb4[,6#...]`         |
| `dnsmasq.servers`    | `server=/domain/` (block) / `server=/domain/#` (allow) |
| `smartdns.domainset` | Raw domain (with smartdns conf wrapper)          |
| `smartdns.ipset`     | Raw domain (with smartdns ipset conf)            |
| `smartdns.nftset`    | Raw domain (with smartdns nftset conf)           |
| `unbound.adb_list`   | `local-zone: "domain." always_nxdomain`          |

The download pipeline auto-detects blocklist format from content:

| Format       | Detection                           | Example                    |
|--------------|-------------------------------------|----------------------------|
| AdBlock Plus | `[Adblock Plus]` header / `^||`     | `\|\|example.com^`         |
| dnsmasq      | `^server=`                          | `server=/example.com/`     |
| dnsmasq2     | `^local=`                           | `local=/example.com/`      |
| dnsmasq3     | `^address=`                         | `address=/example.com/0.0.0.0` |
| hosts        | `^0.0.0.0\s` or `^127.0.0.1\s`     | `0.0.0.0 example.com`     |
| domains      | (fallback — plain domain list)      | `example.com`              |

```
For each file_url UCI section:
  → Download URL (curl with retries, timeout, optional max-file-size)
  → Auto-detect format → Apply format-specific sed filter → Extract domains
  → Append to accumulator (blocked or allowed)

Merge phase:
  → sort -u (deduplicate)
  → Subdomain optimization (awk label-reverse → sort → dedup → reverse)
  → Remove allowed domains (sed -f generated_script)
  → Inject canary domains (iCloud Private Relay, Mozilla DoH)
  → Inject manually blocked_domain entries from config
  → Format for target DNS resolver
  → Optional validity check (remove malformed entries)
  → Atomic rename to output file

Resolver phase:
  → Update resolver config (UCI: addnhosts, conf-dir, server files)
  → Sanity check (dnsmasq --test)
  → Restart resolver service
  → Heartbeat probe (resolve canary domain to verify blocking)
  → Revert on failure
```

| Function              | Purpose                                              |
|-----------------------|------------------------------------------------------|
| `start(args)`         | Main lifecycle: download, restore from cache, or restart |
| `stop()`              | Disable blocking, flush kernel state, cleanup        |
| `status_service()`    | Report status to syslog/ubus                         |
| `allow(domain)`       | Whitelist domain in live blocklist + UCI config       |
| `check(pattern)`      | Search current blocklist for domain                  |
| `check_tld()`         | Detect TLD entries (sanity check)                    |
| `check_leading_dot()` | Detect leading-dot errors                            |
| `check_lists(domain)` | Search upstream list URLs for domain                 |
| `dl()`                | Force re-download all lists                          |
| `killcache()`         | Purge all cached files                               |
| `pause(seconds)`      | Temporarily disable blocking                         |
| `show_blocklist()`    | Output parsed blocklist to stdout                    |
| `sizes()`             | Fetch/display configured blocklist file sizes        |
| `get_init_status()`   | Full service state for UI/RPC clients                |
| `get_init_list()`     | Enabled/disabled status                              |
| `get_platform_support()` | Detect installed resolvers and features           |
| `get_file_url_filesizes()` | Return cached/live URL metadata                |

- 40+ localized message codes (e.g., `errorDownloadingList`,
  `errorConfigValidationFail`, `warningSanityCheckTLD`)
- Errors/warnings accumulated in `status_data{}` arrays
- Synced atomically to ubus service data for UI consumption
- Status states: `statusSuccess`, `statusFail`, `statusDownloading`,
  `statusProcessing`, `statusRestarting`, `statusPaused`

---

The init script (`/etc/init.d/adblock-fast`) is reduced from ~2,700 to ~130
lines. It now serves exclusively as a procd service wrapper:

- **procd lifecycle**: `start_service()` calls ucode `start`, captures
  shell output for `service_data()`; `stop_service()` calls ucode `stop`
- **Service triggers**: WAN interface triggers, config change triggers, UCI
  validation (unchanged from previous version)
- **Extra commands**: `allow`, `check`, `check_tld`, `check_leading_dot`,
  `check_lists`, `dl`, `killcache`, `pause`, `show_blocklist`, `sizes`,
  `version` — all delegate directly to ucode CLI dispatcher
- **procd data bridge**: `emit_procd_shell()` in ucode generates shell
  statements that the init script `eval`s for `service_data()` and
  `service_stopped()`/`service_started()` hooks (firewall restart flag)

---

The `90-adblock-fast` uci-defaults script is simplified from 181 to 65
lines:

- **Removed**: Entire `simple-adblock` migration path (config, cache files,
  URL lists). This migration was for the initial transition from
  simple-adblock to adblock-fast and is no longer needed.
- **Retained**: List name migration (adds `name` option to `file_url`
  sections that lack one, using pristine default config as reference),
  config key renames (`debug` → `debug_init_script`, `proc_debug` →
  `debug_performance`, `sanity_check` → `dnsmasq_sanity_check`)
- **Simplified**: Uses direct `uci` commands instead of sourcing the init
  script for `uci_get`/`uci_set` helpers. Pristine config lookup now
  supports both apk (`.apk-new`) and opkg (`-opkg`) package manager
  conventions.

---

A full test suite is added in `net/adblock-fast/tests/` (16 new files,
~1,800 lines) mock-and-expect pattern.

- **Module patching**: Converts ES6 imports to CommonJS requires, redirects
  hardcoded system paths to temp directories for isolation
- **Resolver stubs**: Mock binaries for dnsmasq (v2.89), smartdns, unbound,
  ipset, nft, resolveip
- **Test case format**: Markup-based (`-- Testcase --`,
  `-- Environment --`, `-- Expect stdout --`, `-- File path --`) with
  support for inline test data and per-test environment overrides
- **Assertion model**: Compares stdout, stderr, and exit code against
  expected values using `diff -u`
- **Shell validation**: Syntax-checks init.d and uci-defaults scripts via
  `sh -n`
- **Automatic cleanup**: Trap-based temp directory removal

**UCI Mock** (`tests/lib/mocklib/uci.uc`):
- Full `cursor()` interface: `load`, `get`, `get_all`, `foreach`, `set`,
  `delete`, `list_add`, `list_remove`, `commit`, `changes`
- Loads JSON fixtures from `tests/mocks/uci/` (adblock-fast, dhcp, network,
  smartdns, unbound configs)
- Supports `@type[index]` extended section addressing

**ubus Mock** (`tests/lib/mocklib/ubus.uc`):
- `connect()` → `call(object, method, args)` with signature-based fixture
  lookup
- Fixtures in `tests/mocks/ubus/` (system info, network interface
  dump/status, dnsmasq service list)

**System Call Interception** (`tests/lib/mocklib.uc`):
- Blocks service operations: `/etc/init.d/*`, `logger`, `sleep`,
  `dnsmasq --test`
- Passes through data processing: `sed`, `sort`, `grep`, `awk`
- Fixed timestamp (`1615382640`) for reproducible output
- Null `getenv()` for environment isolation

**01_pipeline** — Data processing pipeline (9 tests):
1. `01_all_dns_modes` — Verifies all 9 DNS output modes produce valid,
   deduplicated output (~162-165 domains from 2 input lists)
2. `02_input_format_detection` — Validates auto-detection of domains,
   hosts, AdBlock Plus, and dnsmasq input formats
3. `03_subdomain_dedup` — Confirms parent domains retained, child
   subdomains removed (e.g., blocks `example.com`, skips `sub.example.com`)
4. `04_allowed_domains` — Verifies `allowed_domain` config removes domains
   from output while preserving others
5. `05_canary_domains` — Confirms iCloud Private Relay and Mozilla DoH
   canary domain injection when enabled
6. `06_servers_mode_allow` — Validates dnsmasq.servers mode prepends
   explicit allow entries (`server=/domain/#` format)
7. `07_ipv6_addnhosts` — Verifies dual-stack output (both `127.0.0.1` and
   `::` entries) in addnhosts mode with IPv6 enabled
8. `08_ipv6_nftset` — Confirms nftset mode includes IPv6 set references
   (`4#inet#fw4#adb4,6#inet#fw4#adb6`) when IPv6 enabled
9. `09_unbound_header` — Validates `server:` header line prepended in
   unbound output mode

**02_config** — Configuration handling (1 test):
1. `01_blocked_domain_injection` — Verifies `blocked_domain` config entries
   appear in output

**03_functional** — CLI command tests (2 tests):
1. `01_check_domain` — Tests `check()` correctly identifies blocked vs.
   unblocked domains with appropriate output messages
2. `02_show_blocklist` — Tests `show_blocklist()` outputs parsed domain
   list (162 domains, correct format)

5 curated test data files with ~160+ unique test domains across multiple
formats (plain domains, hosts, AdBlock Plus, dnsmasq), including:
- Valid tracking/ad domains for positive matching
- Overlapping domains across files for deduplication testing
- Parent/child domain pairs for subdomain optimization testing
- Invalid entries (IPs, malformed, special chars) for filter robustness
- Mock UCI/ubus fixtures simulating a standard OpenWrt environment
  (512MB RAM, WAN interface up, dnsmasq running)

---

Adds the full AGPL-3.0-or-later license text (661 lines), matching the
`PKG_LICENSE` field already declared in the Makefile.

---

- Package compat bumped from `11` to `13` (in the ucode module's
  `pkg.compat` constant), reflecting the architectural change
- All existing UCI configuration options preserved (same validation schema)
- All existing extra_commands preserved (same CLI interface)
- All existing DNS resolver modes preserved (same output formats)
- procd service triggers and config triggers unchanged
- `simple-adblock` migration path removed from uci-defaults (obsolete)

---

```sh
cd net/adblock-fast/tests && sh run_tests.sh
```

Requires: `ucode`, `ucode-mod-fs`, `ucode-mod-uci`, `ucode-mod-ubus`,
`sed`, `sort`, `grep`, `awk` (standard OpenWrt buildroot tools).

Signed-off-by: Stan Grishin <stangri@melmac.ca>
2026-02-26 17:00:05 -08:00
Daniel F. Dickinson 2859665df9 radicale3: bump to 3.6.1
Update to radicale3 to latest release

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-02-26 14:24:06 +02:00
Toke Høiland-Jørgensen 6c1190469e net/sqm-scripts: bump to v1.7.2
This versions changes the default value of use_mq to off, as a
cautionary measure.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
2026-02-25 15:57:58 +01:00
xiao bo 5a82fcebe8 sing-box: update to 1.12.22
changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.22

Signed-off-by: xiao bo <peterwillcn@gmail.com>
2026-02-24 21:50:33 +02:00
Niklas Thorild 55f8be8cbe telegraf: update to 1.37.3
- Update Telegraf to v1.37.3

Signed-off-by: Niklas Thorild <niklas@thorild.se>
2026-02-24 18:18:50 +02:00
Philip Prindeville a11d53a6c0 clixon: update to 7.7.0
Dropped a size_t patch that was upstreamed.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2026-02-23 16:49:58 -07:00